In a distributed system environment in which many information devices and programs are connected via a wired network or a wireless network, the management of the system is complicated. Resource information such as a large amount of configuration information, performance information, status information, and log information, which are collected from the resources (information devices or programs) configuring the distributed system, must be managed. In particular, to determine an appropriate control for system management, it is essential to accurately keep track of the current system status from the collected information. To do so, it is necessary to chronologically arrange the information, generated by individual resources, for identifying the causality relationship of generated events and numerical changes.
Patent Document 1 discloses an error log collection analysis agent system that, designed for identifying the causes of failures that are generated in an operation system, collects log information output by the products of multiple vendors when failures are generated, arranges them chronologically, arranges the log information according not to the criterion of the importance defined for each product but to the criterion of the importance of the whole operation system, and generates a report on the primary causes of the generated failures and their countermeasures. Although this system points out the importance of chronologically managing the log information output by multiple different products, it is based on a prerequisite that the time synchronization is established in a distributed system. It is clearly specified that the system has the means for establishing time synchronization and, more specifically, it is thought that a possible system have a means using a technology such as NTP (Network Time Protocol; see Non-Patent Document 1).
However, in a large scale system where many computers are connected via the Internet for use in grid computing or in a system where a large number of portable terminals or chips are wirelessly connected for use in ubiquitous computing, it is essentially difficult to time-synchronize all the objects-to-be managed (termed herein “managed objects”). In such an environment, collected information cannot always be managed chronologically but, sometimes, the causality relationship (cause and effect) is reversed with the symptom that an incorrect judgment is made. To avoid such a problem, Patent Document 2 and Patent Document 3 disclose methods for chronologically managing log information or event data in a time-unsynchronized environment.
Patent Document 2 addresses the problem of chronological management of event trace data in a system of multiple, time-unsynchronized computers, and discloses a method for correcting event generation times using offset values indicating time differences among computers.
Patent Document 3 addresses the problem of collecting and analyzing logs generated when failures are generated in computers distributed across many countries and time zones, and discloses a method for correcting the times in the log information using the time difference between a log collecting device and a log-collected device, the time zone information, and the locale information.
Those methods address the problem of the chronological management of resource information in an environment where managed objects are not time-synchronized and the solve the problem by calculating the time difference between a managed object and an information collecting computer as an offset and correcting the information generation times using the offset.
However, in a continuously operating system environment, it is unpredictable when a time difference is generated and when another manager partially corrects the time. So, the offset value is not constant but may be always varied, meaning that the disclosed methods may incorrectly correct times using old offset values. In addition to this problem, it is difficult to provide one centralized management server for use in managing a large distributed system. For this reason, the hierarchical configuration or the distributed configuration (P2P (Peer to Peer) configuration) of management servers is used. For example, DNS (Domain Name System), which provides the name resolution service on the Internet, uses a hierarchical configuration for managing the system domain names around the world.
Therefore, the method for managing the offset values among all managed objects in a large scale system is not practical and, even when the management servers are in a multi-stage configuration, a mechanism for chronologically managing distributed information is necessary. It is also assumed that time is not managed for non-contact type resources such as wirelessly-connected small terminals or IC chips. For those managed objects, it is necessary for an information collection server to estimate information generation times.
Patent Document 1:
Japanese Patent Kokai Publication No. JP-P2003-216457A
Patent Document 2:
Japanese Patent Kokai Publication No. JP-P2005-235054A
Patent Document 3:
Japanese Patent Kokai Publication No. JP-P2005-284520A
Non-Patent Document 1:
David L. Mills “Internet Time Synchronization”, [online], March 1992, IETF, [Searched on Feb. 28, 2005].